Tasks and instructions

You can define all the tasks that might need to be performed by end users, such as an analyst or incident responder.

Tasks can be in the form of a set of instructions or advisories. It can also take the form of an action that a responder selects, which you configure using the Rule feature. When the responder finishes the task, it can be marked and recorded as completed. As you define the tasks, keep in mind your organization’s polices as to responding to a particular situation. These tasks should be specific and repeatable to the incident or situation at hand.

Tasks also play a vital role as a system of record and as a method of training. Analysts new to your organization can quickly learn specific processes by following the playbooks.

You create and manage the pool of tasks in the Phases & Tasks tab under Customization Settings, where you also assign the task to a phase.

You can dynamically add these tasks to a specific incident through playbooks, workflows and the configurations of rules, their conditions and activities. The conditions for adding tasks can be based on the field values of the following objects: incident, tasks, notes, milestones, artifacts, attachments and data tables.